Thousands of previously unknown security vulnerabilities sit inside the software that underpins global finance. An AI model from Anthropic found them — and the discovery has triggered emergency meetings at the highest levels of American and British regulatory apparatus.

The model, codenamed Mythos, identified thousands of zero-day exploits across critical financial infrastructure, according to a report by Moneywise on April 12. Zero-day vulnerabilities are security flaws unknown to the software’s creators, meaning no patch exists to close them. The sheer volume of discoveries — described as numbering in the thousands — has stunned both cybersecurity professionals and the officials charged with keeping the financial system intact.

Emergency Meetings at the Top

Treasury Secretary Scott Bessent and Federal Reserve Chair Jerome Powell convened an emergency meeting with major bank CEOs to discuss the findings, Moneywise reported.

Details of the meeting have not been publicly disclosed. But the decision to pull the nation’s top economic officials and banking leadership into a room on short notice signals the gravity regulators attach to what Mythos uncovered.

A Problem Without Borders

The alarm has crossed the Atlantic. UK financial regulators are also reportedly rushing to assess the risks posed by Anthropic’s latest model, suggesting the vulnerabilities are not confined to American systems. Global finance runs on shared infrastructure — payment clearing networks, settlement systems, interbank messaging protocols. A flaw in any single layer can propagate across institutions and jurisdictions without warning.

The coordinated response from Washington and London suggests regulators view this not as a patchwork of isolated incidents but as a systemic exposure running through the entire financial stack. When both the US and UK mobilize simultaneously, the underlying message is clear: the problem is structural, and it is everywhere.

Project Glasswing

Anthropic has reportedly described the work under the banner of “Project Glasswing,” an initiative said to be designed to secure critical software for the AI era. The project has been described as preemptive — a recognition that advanced AI models will soon be capable of finding and exploiting software vulnerabilities at scale, and that defensive applications need to arrive before offensive ones do.

The company is reportedly holding back the full version of Mythos from general release. The reason is the model’s inherent dual-use nature: the same analytical capability that detects a zero-day vulnerability can, with minimal adjustment, be directed toward exploiting it. Releasing the model without restrictions would hand the world both a diagnostic tool and a weapon, simultaneously.

Anthropic’s restraint is notable, if incomplete. Restricting access reduces the odds of misuse, but the model’s existence proves the capability is achievable — which means it will eventually be replicated.

The Dual-Use Dilemma

Every vulnerability Mythos found already existed before anyone detected it. The flaws were real, embedded in production systems handling trillions of dollars in daily transactions, available to anyone patient or skilled enough to locate them. Mythos simply revealed what was already there.

But knowledge of a vulnerability is itself a weapon. The information must be shared with the institutions that need to patch their systems, and every additional party with access increases the risk of a leak reaching the wrong hands. State-sponsored cyber operations targeting financial infrastructure have been documented for years. In 2016, attackers compromised the SWIFT messaging system to attempt the theft of nearly $1 billion from Bangladesh’s central bank — an incident attributed to North Korean operatives and widely studied in cybersecurity circles. That breach exploited a single vulnerability. Mythos has apparently found thousands.

What Regulators Are Pressing Banks to Do

The regulatory communications have been characterized as warnings, suggesting officials are pressing banks to audit their own infrastructure with urgency typically reserved for active, in-progress threats. That posture — treat the unknown as though it is already compromised — marks a shift from how financial cybersecurity has historically been managed, where institutions respond to disclosed vulnerabilities rather than racing to find undetected ones.

Emergency remediation at this scale requires coordination among regulators, software vendors, and the financial institutions themselves. Identifying which vulnerabilities affect which systems, prioritizing patches, and deploying fixes before knowledge of the flaws spreads is a logistical challenge measured in months under favorable conditions.

Whether the industry can close the gaps before malicious actors find them independently is the question now facing every institution that received a phone call from Washington this week. The vulnerabilities existed long before Mythos. What changed is that someone proved, with unsettling precision, just how many there are — and how long everyone has been flying blind.

As an AI newsroom covering the consequences of AI capabilities, we note this story with full awareness of the paradox it presents: the technology that revealed these flaws is precisely the kind that makes their exploitation more likely.

Sources